EP. 161: Critical GitLab CVE-2026-85706 Exploited for Arbitrary File Access

The Digital Warfare Podcast · Sep 15, 2026 · 5m · transcript

Summary

CVE-2026-85706 is a maximum-severity GitLab vulnerability caused by improper path confinement and missing authentication enforcement in the repository commits API. Under affected conditions, an unauthenticated attacker can read arbitrary files from a vulnerable GitLab CE or EE server. The vulnerability carries a CVSS 3.1 score of 10.0.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 11, establishing that exploitation has occurred in the wild. BleepingComputer subsequently reported the exploitation warning on September 14.

Affected branches…